Skip to content

Fix for deprecated RegEnumKey API usage#8751

Open
sinclairjw wants to merge 3 commits into
osquery:masterfrom
sinclairjw:fix-deprecated-registry-api
Open

Fix for deprecated RegEnumKey API usage#8751
sinclairjw wants to merge 3 commits into
osquery:masterfrom
sinclairjw:fix-deprecated-registry-api

Conversation

@sinclairjw
Copy link
Copy Markdown
Contributor

The getRoamingProfileSids method uses the deprecated Windows registry API RegEnumKey.

This PR updates the API to RegEnumKeyEx without changing any other logic or functionality.

The change has been tested and debugged locally, and no issues found,

@sinclairjw sinclairjw requested review from a team as code owners January 22, 2026 09:54
return std::nullopt;
}

if (max_name_length > 255) {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why disallow this?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this is incorrect. Should be 16,383 as max value name limit not key name.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we are probably ready to proceed with this PR once this is updated. Thanks!

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I attempted a fix. I pushed it into this PR

Comment thread osquery/system/usersgroups/windows/users_service.cpp Outdated
@directionless directionless force-pushed the fix-deprecated-registry-api branch from bc65102 to 4baba24 Compare March 8, 2026 19:07
Copy link
Copy Markdown
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally looking good, but let's at least fix the close.

Comment on lines 74 to 75
auto ret = RegOpenKeyExW(
HKEY_LOCAL_MACHINE, kRegProfileKey.c_str(), 0, KEY_READ, &hkey);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs a matching RegCloseKey call I think (scope_guard ideally).

Comment on lines +87 to +88
// Note: max_subkey_length is at position 6 (lpcbMaxSubKeyLen).
// Position 9 would be lpcbMaxValueNameLen which has a different limit.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems confusing as a code comment since it lacks the old context. Seems more like a PR comment, explaining why the change from the old code.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The value here hasn't changed purpose. It was and is for storing the length of the subkey name string. Maybe the variable name should reflect that. And other variables named "key_" ought to be "subkey_" as well then.

}

subkeys_names.emplace_back(wstringToString(key_name));
subkeys_names.emplace_back(wstringToString(key_name.c_str()));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

std::string wstringToString(const std::wstring& src) {

The wStringToString takes a std::wstring reference here, so the .c_str() seems incorrect.


std::wstring key_name;
key_name.resize(max_key_length);
key_name.resize(max_subkey_length + 1);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch 😀 the null terminator wasn't being accounted for. Note: In cases where the subkey name was of the max length, the API call would have previously errored with ERROR_MORE_DATA.

Comment on lines +87 to +88
// Note: max_subkey_length is at position 6 (lpcbMaxSubKeyLen).
// Position 9 would be lpcbMaxValueNameLen which has a different limit.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The value here hasn't changed purpose. It was and is for storing the length of the subkey name string. Maybe the variable name should reflect that. And other variables named "key_" ought to be "subkey_" as well then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants